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Abstract 

The invention of the one-time pad is generally credited to Gilbert S. Vemam and Joseph O. Mauborgne. We 
show that it was invented about 35 years earlier by a Sacramento banker named Frank Miller. We provide a tentative 
identification of which Frank Miller it was, and speculate on whether or not Mauborgne might have known of Miller's 
work, especially via his colleague Parker Hitt. 

1 Introduction 

One-time pads are in theory the strongest possible algorithmic cipher: if the key is used properly, they cannot be 
broken, even in theory. The invention of the one-time pad is generally credited to Gilbert S. Vernam of Bell Telephone 
Laboratories and Joseph O. Mauborgne of the U.S. Army Signal Corps |29, 60|. Vernam invented a device that would 
exclusive-OR keystream bits from a paper tape with the Baudot code generated by letters typed on a keyboard; he 
and Mauborgne realized that if the keystream tape characters were (a) perfectly random, and (b) never reused, "the 
messages are rendered entirely secret, and are impossible to analyze without the key" |60|. (To be sure, others have 
made similar assertions about their ciphers; Vernam and Mauborgne's claim has the advantages of being both correct 
and mathematically provable.) 

In fact, they were anticipated by about 35 years. In 1882, a California banker named Frank Miller published 
Telegraphic Code to Insure Privacy and Secrecy in the Transmission of Telegrams. In it, he describes the first one-time 
pad system, as a superencipherment mechanism for his telegraph code t42i . If used properly, it would have had the 
same property of absolute security. 

Although in theory Miller can claim priority, reality is more complex. As will be explained below, it is quite 
unlikely that either he or anyone else ever used his system for real messages; in fact, it is unclear if anyone other than 
he and his friends and family ever knew of its existence. That said, there are some possible links to Mauborgne. It 
thus remains unclear who should be credited with effectively inventing the one-time pad. 

We start by describing and analyzing Miller's codebook. We then explain our tentative identification of the author, 
and speculate on possible linkages to Mauborgne. 

2 The State of 19th Century Cryptography 

It is worth discussing common 19th century cryptography, to better understand Miller's starting point. The state of the 
art, at least in the United States, was very poor f\M Lecture V]. Broadly speaking, two principle systems were in use, 
straight-forward ciphers and superenciphered codes. Both were rather simple. (For further background, also see ||62| 
and 163 1.) 

*Note: this is a preprint copy of a paper that has been submitted for publication. The iinal form may vary significantly. 
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During the Civil War, the Confederacy primarily used a Vignere cipher (which they often called a "court" or "diplo- 
matic" cipher) f49l, via manual tables [IT, Lecture IV]. A Vignere square was also used by John Wilkes Booth and 
others in their plot against Lincoln. The Confederacy often used meaningful phrases as high-level keys; in February 
1865 they switched to "Come Retribution" from "Complete Victory" ||59| . 

The Union employed a cipher disk to implement an easy-to-change monoalphabetic substitution. The key — that 
is, the rotation — could be changed in mid-message, or by switching disks. It also employed Stager's route trans- 
position cipher ||29ll49ll63l . which combined a codebook for (many) proper names with a word-based transposition. 
(An advantage of transposing words, rather than characters, is that it allowed telegraph operators to correct many 
transmission errors.) 

Codebooks were certainly not new. In some form, they go back to the optical telegraphs of the 18th century 1571 : 
superencipherment goes back to the very first telegraph codebook, compiled by Smith in 1845 |54|. His codebook 
represented each word as a letter/number pair. He described using an additive to provide confidentiality, and even 
described using different additives for different codewords: 

For instances, instead of confining the pre-agreements of the parties, to the deduction or addition of one 
number only, let one number be agreed on, for every alternate word sent in figures, and another number 
for every other word; or, by the same rule, let several numbers be used for addition or deduction, in any 
order that may be agreed on. 

In addition, he suggested the use of a monoalphabetic substitution of the code letter. 

Few late-19th century codebooks were much better at superencryption. The 1899 U.S. War Department code 
||25l , though intended primarily for administrative use, did provide for superencipherment; it was less sophisticated 
than Smith's. It suggested adding or subtracting a "key number or series of key numbers", and gave as examples 
the sequence "25, 50, 75, 100". It did, however, note that "the use of 50 or 100, while easy to remember, should be 
avoided". 

One well-known codebook stood out. Slater's Telegraphic Code, to Ensure Secresy in the Transmission of Tele- 
grams [sic] f52l talked about simple additives, but he also described a variety of more complex transforms. For 
example, he suggested transposing digits in code numbers, or regrouping the 5-digit code numbers into 4-digit ones. 
In addition, he suggested using combinations of these methods. Despite its limitations. Slater's codebook became the 
basis of a War Department code fl4l |63 I. (Curiously, Friedman's discussion of Slater's superencipherment focuses 
only on the use of additives, and misses the more complex transformations 1 14, p. 96].) 

None of these schemes were that sophisticated. Friedman conjectures that European cryptanalysts were able to 
read American State Department correspondence with little trouble. 

3 Miller's Codebook 

Miller's codebook has two independent components, a conventional telegraph code intended for message compression 
and a superencipherment system. The telegraph code is conventional for its time: it mapped phrases into both English 
words and 5-digit code groups. While an 1882 codebook cannot be rated against the very sophisticated works produced 
in the 1920s and 1930s, it does not appear to be a particularly good compression system even when ranked against its 
peers. Contrast a page from Miller's book (Figure[T]i with one from Bloomer's 1874 codebook (Figure|2]i, another one 
intended to provide confidentiality 1 19]; in general. Miller maps a single plaintext word into a single codeword, though 
there are glaring exceptions such as the entire paragraphs that are represented by FESTIVAL or FESTIVITY, while 
most of Bloomer's code words represented phrases. (Bloomer also understood security better than most. Although 
he did not carry out the work himself, he apparently recognized the virtue of two-part codes; the book provides 
instructions on how to generate one and blank columns in which to write alternate code numbers.) 

One of Miller's codewords, GUINEAPIG, is interesting both because it shows the limitations of the code but also 
for what it says about authentication over the years: 
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Endeavored 0J3fl7 Fermenting 

EodlesB 04368 Fernowl 

Endorsation-I-B 04269 Fernticles 

Endorse-t-a-l-int' 04370 Ferocious 

Not endorse-f B-|-ing 04371 Ferocity 

Endorsed 04273 Ferrandine 

Not endorsed 04373 Ferreous 

To endorse 04374 Ferret 

Not to endorse 04275 Ferreting 

To be endorsed 04376 Ferretto 

Not to be endorsed 04377 Ferriage 

Endorsed as follows : 04278 Ferried 

Not endorsed by 0437» Ferryboat 

Endorsed in blank 04380 Ferryman 

Endorsed to order 04381 Fertile 

Endorse witboat recourse 04383 Fertilize 

Endorsed to order of— 04388 Ferola 

Endorsed by agent or olerfc 04384 Ferrently 

Endorsee-I^ 04385 Fervescent 

Endorsemeot+s 04386 Fervid 

Endorsement-j-s of 04387 Fervidoess 

Endorser+B 04288 Fervor 

Eadorsements.— U. S. Treasary Circular of April 
6, 1881 : 

Tbe name of tbe payee, as endorsed, must cor- 
respond in spelling with tbat ou the face of the 
draft ; no guarantee of an endorsement, imperfect 
in itself, can Iw accepted. If tbe name of a payee 
as written on tbe face of » draft Is spelled incor- 
rectly, the 0raft should be returned to tbe Treas- 
urer U. S. for correction 0428D Fescenaine 

Endorsements by mark (x) must be witnessed 
by two persons who can write, giving tl^eir places 
of residence 04300 Fessltudo 

Endorsements by execntors, adndnistratora, 
guardians, or other fiduciaries must be accompa- 
nied by certified copies, under seal, of letters tes- 
tamentary, letters of administration, of guardian- 
ship, or other evidence of fiduciary character, as 
the case may be 04391 Festally 

Payees and endorsees must endorse by their 
own bands ; o£Bcials, o£Qcially with full title; 
firms, the usual firm-signature by a member of 
the firm, not by a clerk or other person for the 
firm 04302 Festering 

Every endorsement mnst be by the proper writ- 
ten (not printed) signature of the person whose 
endorsement is required 0^93 Festival 

Powers of attorney for the endorsement of 
drafts in payment of claims must state tbe num- 
ber, date, and amount of draft, and number and 
kind of warrant, and be dated subsequently to 
tbe date of the drafts ; must be witnessed by two 
persons, and must be acknowledged hf the con- 
stituent before tbe Treasurer of the United States 
or an Assistant Treasurer, a Judge or Clerk of a , 
District Court of the United States, a Collector of 
Customs, a Notary Public under his seal, .or a 
Justice of tbe Peace in those Statra only in which 
such Justice has authority to take acknowledg- 
ments of deeds, or Commissioner of Deeds ; if be- 
fore either of the two latter, the certificate and 
seal of the County Clerk ns to the official charac- . 
ter and signature of the Justice or Commissioner 
is required. If executed in a foreign country, the 
acknowledgment must be made before a Notary 
Public, wiib his seal attached, or a U. S. Consul 
or Minister. The officer taking the acknowledg- 



read and fully esplaiued to the constiLucut at the 
time of acknowledgment, and that said constitu- 
ent is personally well known to him to be the 
identical person named in and who subscribed his 
name to said power of attorney. (See Revised 
Statutes, Sees. 1778 and 8477.) 04!^ Festivity 

Evidence of authority to endorse for incorpo- 
rated or unincorporated companies must accom- 
pany drafts drawn or endorsed to the order of 
such companies or aBSOciations. Such evidence 
should be in the form of an extract from the by- 
laws Gt records of the otmpany or association, 
sliowing the authority of the officer to endorse and 
receive and receipt for mont-ys for the company, 
and giving bis name and the date of bis election 
or appointment, wlilch extract must be verified 
by a certificate under seal ^gned by the President 
and Secretary or by one of these officers and not 
less than two of tbe Directors; which certificate 
must state that sucli authority remuina unrevoked 
and unchanged. If the company have no seal, 
the extract should be certified as correct by a 
Notaiy Public or other competent officer under 
bis seal. Wben a resolution is adopted at a spe- 
cial meeting of Directors, it must be shown that 
all had notice of tbe time and place of Buch meet- 
ing and that a quorum assented to the resolution. 

Tbe endorsement of all the joint holders or co- 
trustees, executors, administrators, guardians, or 
ottier fiduciaries will be required on drafts, and 
in tbe execution of a power to a third party to 
collect, all must join. In case of tbe death of 
either, tbe survivors will be recognized as having 
full authority, upon due proof of audi death and 

BurviTorsliip 04305 Festoon 

Endowment-|--B> 04296 Festooned 

Endure-i-s-fring 04307 Festucine 

Endured... 04298 Festucous 

Endways 04309 Fetched 

Euemy+ies 04800 Fetching 

Energy-fetic-|-ally *. 04801 Feticbism 

Enforce-|-s-|-ing 04303 Feticide 

Enforced 04303 Fetidness 

Engage+B-fing 04804 Fetish 

Engaged , 04306 Fetlock 

Eogagemeotr|-s 04306 Fetterless 

Engiue-f-8 04307 Fetters 

Engineer+s+ing 04308 Feudal 

Engineered 04800 Feudality 

England 04310 Fendary 

Engliflh-l-man 04311 Fevered 

Engrave-fs+ing 04313 Feverfew 

Engraved 04313 Feverish 

Engraver+s 04314 Fewest 

Engraving Company 04815 Fewness 

Eugross+es+ing C4316 Fiacre 

Engrossed .~. 04317 Fibbing 

Enhance+s+ing 04318 Fibreless 

Enhanced 04319 Fibrine 

EnjoLn-)-s-f-ing 04330 Fibrous 

Enjoined 04331 Fibula 

Enjoy-fs+iiig 04333 Fickleness 

Enjoyed 04333 Fictions 

Enlarge+B+ing 04334 Fiddlers 

Enlarged 04335 Fidelity 

Enlargement-fs 04326 Fidgeted 

Enlist+s+ing 04837 Fiducial 

Enlisted 04328 Fieldfare 

Enmity 04339 Fields 

Enormous4-ly 04330 Fiendish 



Figure 1: A sample page from Miller's codebook. Note the general lack of compression; most codewords, with a few 
exceptions and a few glaring exceptions, represent a single plaintext word rather than a phrase. 
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Yon. 



Hip. 



{ 42IU 



4212 
4213 

4214 

421 

4216 

4S17 

4218 
4219 
4220 
4221 

4222 
4223 
4224 
4225 



42a(; 

4227 

4228 
4229 
4230 
4231 

4233 

4233 

423J 



SENTESCES, 



Von can tube dnft on as for.. 



Von moflt adTiae lu of bU drafia if joa vrish 
them faoDored ......... 



Yoo mtut have neglected to cradit commia- 
aioiM in the amount of draft 



Voa most make your orerdraft good. 



Voa must pot na in fanda to meet yonr draft 
for 



Your draft 

Yonr draft for.. 



Vonr draft for baa been preaented ; will 

not aecept onleaa pntin fnnda 



Yonr draft for baa been preaented ; will 

not arcept nnleaa put in fnnda for amount 
already overdrawn 



Yonr draft on na ie due , 

Yonr draft on oB ia due for.. 

Your draft on na will be duly honored. 



Yonr draft refnaed aceeptanoe fbr want of 
advice 



NOTES. 



When is note due? 

Will you give note to the amonnt of- 
payable iu 7.... * 



Will you give ub your note for T.... 

Will yoa take oar note 1 

Will yon talie our uote payable in T . 



Will you take our note payable in thirty 
liHys' ? 



Will you take our note payable in sixty 
days ? 



Will you take our note payable in ninety 
day'e 7 



Note 

423j|Note diMOunted-. 
42aH|Note for , 



Xo. of Ci- 
pher Won". 



180 



No 



1210 
1211 



V2l;j 

42ie 

1: 
1218 
1219 

1221 

1222 
■122^ 
J224 
4225 



I22f3 

12; 
122S 
1239 
1230 

4231 

1232 

4233 
4234 
4235 
1236 



Cipber. 



, AO. or 



HippogrifT.. 

Ilippola — 



Hipponax 
IXippopbagi . 



Hippurie . 
Hippos ... 
Uipehot .. 



Hipwort.. 



Ilimm.... 
Elireless.. 
Hireling.. 
Hirsate. . 



Hirando .. . 

Hias 

Hissing. ... 
Histogeny . 
Historify . . 



History , 



Hitch , 

Hither .... 
HitbermoBt ■ 

Hive 



Hoard.. . 
Hoarder . 



Hoarhound 
Hoariness . 

Hoarse 

Hoax 



Digitized by 



Google 



Figure 2: A sample page from Bloomer's codebook. The blank columns permit conversion into a two-part code. 



SPECIAL LIST BETWEEN THE HOLDER OF THIS BOOK AUD. 



12303 SelfUelp 

12303 Selfish 

• 12301 Selflove 

1230S Bellmoved 

12806 Selftougbt 

12307 SelfwiU 

12308 SelvngB 

Figure 3: Blank codewords, for use with a particular correspondent. 

Identity can be established if tlie party will! 
answer that his or her mother's maiden name [• 05626 Guineapig 



Mother's maiden name, that old standby "secret", was used that way at least as early as 1882. 

Note, though, that there is a crucial security failure here: that codeword, suitably shifted, is to be followed by the 
secret, and the secret almost certainly has to be in plaintext: there won't be a codeword for most family names. The 
appearance of something that looks like a family name and is a word not in the codebook would quite likely be of 
interest to any eavesdropper The alternative is using codewords to spell out the name, but that will result in a large 
expansion of the message and hence an increase in cost. This, of course, is a failure mode of all codebooks, not just 
Miller's, but it does show the limitations of Miller's code for one of its intended purposes. (We note that the 1899 
Preliminary War Department Telegraphic Code 1251 included codewords for all officers then in the Army, to avoid 
precisely this problem.) 

Miller's codebook was not as easy to use as some. It mostly lacked subject divisions; encoders would have had to 
find each phrase alphabetically, and perhaps guess at precisely which word the phrase was indexed under A clerk who 
is experienced with a given codebook would be less inconvenienced; this, however, creates a bias in favor of sticking 
with more familiar works. (Familiarity can help. Lord Nelson's famous signal "England expects that every man will 
do his duty" originally started "England confides that. . . ". However, his signal officer pointed out that "confides" was 
not in the codebook, and hence would be slower to send, whereas "expects" was. Nelson agreed to the change |24|.) 

Given the poor compression and usability, and given that telegraph codebooks are subject to a network effect — a 
codebook owned by many recipients is more valuable to a sender than one owned by just a few — we suspect that it 
was little-used in practice. The problem was likely exacerbated by a lack of marketing: Miller had a full-time job as a 
banker, and probably couldn't spend his time persuading other banks to use his code book. As in so many other fields, 
marketing is extremely important when selling codebooks |29', 30 1. 

One unusual feature of the codebook does warrant further attention. As with virtually all codebooks, this one 
has blank positions for user-supplied plaintext; see, for example, the middle section of Figure |2] Miller, by contrast, 
provided about 20 pages of pair- wise lists of extra words; each such page was intended for correspondence with a 
different individual (Figure |3]l. This clearly shows his orientation towards point-to-point communication, rather than 
one-to-many or many-to-many. Any realistic use of one-time pads would indeed require point-to-point messaging. A 
broadcast scenario, where one party sent to multiple others, would require everyone to have a receive-only list; Miller 
does not describe any such thing. Given the lack of broadcast transmission media then, this is not surprising. 

Miller's superencipherment, by means of additives and modular arithmetic, is much more interesting. As noted 
earlier, additives were well-known. Miller, however, identified the essence of the one-time pad: randomness and 
non-repetition [emphasis in the original] : 

A banker in the West should prepare a list of irregular numbers, to be called "shift-numbers," such as 483, 
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281, 175,892, &c. 

The differences between such numbers must not be regular. 

When a shift-number has been appHed, or used, it must be erased from the list and not used again. 

A copy of the list is to be sent to the New York Banker, who prepares a different list and sends copy 
thereof to the Western Banker. 

It seems clear that Miller understood the threat he was countering: "Any system which allows a cipher word to be 
used twice with the same signification is open to detection. A little talk with a telegraph operator will convince one of 
this fact." One can, of course, question how deep his understanding was of the cryptanalytic threat, but it's hard to be 
clearer than that in a single sentence. 

Is this a true one-time pad? Kahn defines such a system as one consisting of "a random key used once, and only 
once" fSO' p. 398]. That Miller understood the "once, and only once" part is clear But is "the differences . . . must not 
be regular" equivalent to "random"? We submit that it is. He stressed the phrase, showing that he thought patterns 
were a serious, exploitable flaw. It would have been nice, though, if he had explained techniques for generating the 
additives, and if his samples had not all been 3-digit numbers. (According to Kahn, Vernam and his colleagues used 
"characters drawn from a hat" for keying material.) 

Miller also thought about the threat model. He suggested that messages that could be sent verbally by a messenger 
need not be encrypted, though he also noted that as a practical matter not many people in a town would possess the 
codebook. Even then, however, he realized that messages needed to be authenticated, even if not encrypted. To this 
end, he provided a list of 100 "test words"; a sender would take the next available shift-number modulo 100 and use 
that to select the appropriate test word. The receiver would verify the test word against his list of shift-numbers; both 
parties, of course, would cancel that value. Miller does not seem to have considered that a telegraph operator could 
substitute a different message to one protected by a simple authentic at or, nor does he mention that receivers must be 
properly trained to insist that all messages be authenticated. By contrast. Slater's authentication codebook recognizes 
both problems |51 , pp. 4-5]: 

In very many cases, however, and it is surprising in how many, the receivers of messages purporting to 
come from some well-known correspondent, take it for granted that every telegram which so reaches their 
hand must be genuine, and, without further consideration of the consequences, act upon it. 

There still remains, however, the possibility of a fraud being committed, as it were, over the blank signa- 
ture of the sender, by a dishonest servant who may be entrusted to carry to the telegraph office the message 
it is intended to transmit, inasmuch as he would have it in his power to substitute another message drawn 
up in his own interests and certified by his master's test, or to interpolate some additional words of his 
own. 

and 

Nothing then is easier for a dishonest cable operator than the commission of a fraud of gigantic extent. 

The concept of the test word as a message authenticator appears to have been relatively new to telegraphy at the 
time. "Test word" itself appears to have been a reasonably-common 19th century phrase for actions or writing designed 
to prove something or someone authentic or genuine. The Freemasons are claimed have employed a secret test word 
IP, p. 86], as did the Templai-s fST, p. 122] and the Ku Klux Klan 1 15 , p. 24]. (Though |18 | and |15| ai-e works by 
outsiders attacking the Freemasons and the Klan, that does not affect our point: both works use the phrase "test word" 
without further explication, buttressing our assertion that readers were familiar with the concept.) The earliest use we 
have found in telegraphy was just six years before Miller, by Slater 151]; in essence, he suggests use of a book code 
to authenticate messages. He also gives a number of variants to protect the date, word count, etc. Interestingly, he 
suggests using sentences; this way, a missing word can indicate that a particular message was never received. Miller 
put the phrase "test word" in quotes, as if his audience might not be familiar with it in this context. It is unclear if 
Miller was familiar with Slater's book (which was much less well known than his secrecy code l,52J ). While we do 
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not know if Miller was a member of any quasi-secret fraternal organization, he was an officer of the Grand Army of 
the Republic |47|, a Civil War veterans' association which is said to have used Masonic rituals |[33l and certainly kept 
them secret |17|. 

Use of test words in telegrams did become commonplace later on. Lieber BTl references the phrase, though 
without explanation. (TT, p. 155] describes how Wells Fargo used test words on internal telegrams. By the time of 
World War I, test words were sufficiently common that there were special provisions in the censorship regulations to 
accept such words that were not in the standard codebooks ||T3[ p. 40]. A banking textbook ||40[ p. 170] gives a detailed 
explanation of how test words are added and verified by a special department in the bank. 

Checksums appear to date from the same period as Miller's book. For example, during an 1881 meeting of the 
Royal Astronomy Society, Lord Crawford said BSl p. 170] 

Mr. Ritchie opened a communication with me a short time ago, with a view of introducing a method, 
which he and Mr Chandler had contrived, for the despatch of astronomical information of interest. 
By this method the elements and the ephemeris, which are comprised in twelve lines of printing, were 
transmitted in sixteen words on a cipher telegram. We cannot go wrong in the telegram, because one 
test-word checks the whole message. 

The full scheme was published a few years later by Chandler and Ritchie fTH). 

For all its cryptographic sophistication, we doubt that Miller's superencipherment system was ever used in prac- 
tice: there are some serious operational deficiencies. The most important is the lack of any indicators to show where 
in the shift-number list the sender started; the scheme as described assumes that all messages are delivered, received, 
and decrypted in order. This is not a realistic assumption; a high-priority telegram composed late in the day would 
arrive before a "night letter" composed earlier. Real-world one-time pads generally use something like a page num- 
ber/additive number pair to show where to start decrypting. There is one nod in that direction — the codeword 
PECCADILLO means "For this and all other dispatches from us we beg that you will use 'shift-numbers' from our 
list commencing next below Number " — but that is rather clumsier than using indicators routinely. 

There are also two codewords to deal with a shortage known to one side but not the other PEBBLES means "send 
more shift numbers"; PECANA means "No shift numbers here available, so use the 'plain cipher' [the codebook 
without superencryption] or English". However, the sender's list has to be in synchrony with the receiver's; one side 
can't run out without the other knowing it 161]. Possibly, the intent was to deal with exception cases, such as loss 
or compromise of an additive list; if so, one would expect special codegroups to indicate the problem, and most like 
coupled with the "send more" message. 



4 Who Was Frank Miller? 

It is difficult, at this remove in time, to be certain just which Frank Miller developed the one-time pad system. (To 
avoid confusion, in this section we will refer to the author of B2l as the "compiler", and reserve the proper name 
"Frank Miller" for a particular historical figure.) That said, there are enough clues that — aided by happenstance — 
we have come to a strong, albeit not certain, conclusion. We believe that the compiler is the Frank Miller who later 
became the president of the National Bank of D.O. Mills & Co. in Sacramento, as well as one of the founding trustees 
of Stanford University. 

The codebook itself offers a few concrete details. The copyright page identifies the compiler as living in Sacra- 
mento. In the preface, he describes himself as having "sixteen years' banking experience". Sixteen years before the 
publication date was 1866, immediately after the U.S. Civil War ended; this would be a logical time for a young man 
leaving the army to have started a permanent job. It also seems likely that the compiler had at least some acquaintance 
with cryptanalysis. 

The population of Sacramento was not large at the time, probably around 35,000-36,000 given the 1880 and 1890 
census figures {] There were 14,526 males over 21 years old in 1880, reducing the set still further. (That figure was not 
collected in 1890.) 



'Data retrieved from the University of Virginia Library Historical Census Browser, http : / /mapserver . lib . Virginia . edu/ 



7 



We know that there were not many banks in Sacra- 
mento then ifT^ 154) . Conceivably, of course, some- 
one could have worked at other banks before moving 
to Sacramento; that said, a Frank Miller who did start 
at a Sacramento bank in 1866 would very likely be the 
person we are looking for Assorted Internet searches 
turned up a published genealogical history ||50l that de- 
scribes a person with precisely those characteristics; ex- 
cept as otherwise indicated, the biographical informa- 
tion in the remainder of this chapter is taken from it. 
(The other valuable source was a brief 1896 biography 
of Miller in Overland Monthly |47|. To modem eyes, 
that one starts strangely, addressing him as "Comrade 
Frank Miller" and describing him as coming from "good 
old revolutionary stock", phrases we would regard as 
more apt for a descendant of a veteran of Mao's Long 
March than for a California banker) Additionally, cen- 
sus record searches via www.familysearch.org] 
show just two Frank Millers in Sacramento in 1880; 
one worked at the D.O. Mills bank and the other was 
a "laboror" [sic]j^ 

Frank (or Franklin) Miller was bom in Milwaukee on 
18 January, 1842, the son of Henry and Nancy Robinson 
Miller. His family moved to Sacramento in 1856 150] 
or 1857 |47 1 (though |IT|, an obituary for his father from 
the Sacramento Record-Union, says 1850). He attended 
Phillips Academy in Exeter, New Hampshire, enrolled at 
Yale in 1861, and enlisted in the Second Wisconsin Vol- 
unteer Infantry regiment in 1862. He fought at Antietam 
and was wounded at the Second Battle of Bull Run. 

In 1863, Miller, by then a sergeant, was transferred 
to clerical duties in the Inspector General's office. The 

following year he was "promoted to a civil clerkship" in New York BTI working for Colonel Henry Steel Olcott, a 
prominent investigator of fraud and corruption during the Civil War |43 58 |j^ Olcott offered to assist in investigating 
Lincoln's assassination; Secretary of War Stanton replied, "come and bring your force of detectives" ||231|43 1. He was 
apparently effective, being described as "the most conscientious member of the investigative team" ll32ll . Miller ap- 
parently came with that "force of detectives", though we do not know what his role was. We suspect that it was during 
the 1863-1865 period, investigating various crimes and peculations, that Miller became acquainted with encryption 
and perhaps cryptanalysis. 

Miller's father was the founding vice president of the D.O. Mills bank; Frank Miller was the "cashier". On 
his father's death in 1878 he became vice president; he became president in 1893 when Edgar Mills, the founding 
president, died. Miller retired as president in 1904 |3|. After that, he was no longer resided full-time in Sacramento; 
he and his wife traveled a great deal and resided in a number of different places before settling down in Berkeley in 
1910 or 1911. He and his wife moved to the Pendleton Hotel in San Francisco in 1905 04] after spending a year or 
so in Europe; they moved to Sausalito for the summer of 1906 ||35l and ended up staying there ||37J , probably because 




Figure 4: Frank Miller in 1896. (Picture taken from 1471 . 
from an electronic copy held by the University of Michigan 
Digital Library.) 



^The census record for the banker Frank Mills at 
|https : / /www . f amily search . org/ s/ recordPetails/ show?uri=http : //pilot . family search .org/ recor ds /trk : | 
|/f srs/rr_2 069562 90/p_334 654 8 61&hash=HloWXpZgU9zB10k5M56iYku8TUc%253D shows a birth year of 1850, which is 
inconsistent with other sources and difficult to reconcile with Civil War service. The other data listed agree so well with 1501 that we suspect an 
error in the record or in its digitization. 

Olcott himself had a very colorful career. After the war, he became a lawyer He grew interested in spiritualism, converted to Buddhism, and 
was one of the founders of the American Theosophical Society. Most of the published information on him concentrates on his religious career. 



8 



of the 1906 earthquake and fire. Fortuitously, that move took place a few days before the quake (36^. He did plan to 
return frequently to San Francisco; he was one of the guests of honor at a banquet scheduled for 20 April 1906 |5 1, and 
he and his wife had purchased opera tickets for the forthcoming season [8J. They also returned to Sacramento often 
||4]|6l|2l[36l, as well as traveling to Oregon where Miller had significant business interests |[3]. 

We know little of Miller as a person. Examination of his correspondence to and from the president and trustees 
of Stanford University ||2l |9l suggests that he was a forthright, blunt, almost brusque individual; he concluded more 
than one letter with "do not bother to answer this" or similar words. Another letter, evaluating a proposed personnel 
policy, concluded with "He is not so competent, nor is any other man." He resigned as a trustee in 1916 — a post that, 
from his resignation letter, he valued highly — because of ill health |9| and failing eyesight |50|. His relations with 
one of his sons was strained, apparently over financial issues but with the sense that he thought this son was rather 
irresponsible. 

At some point, the compiler acquired an interest in communications. The codebook's preface quotes a "Colonel 
Myers" [sic] on the value of cryptography; this is Albert J. Myer, the father of the U.S. Army Signal Corps, and the 
quote is slightly paraphrased from from Myer's classic work "A Manual of Signals" |45 |. (Myer is also considered 
the father of the Weather Bureau; as a result, he was sometimes known as "Old Probabilities" |63 |.) It is worth noting 
that the passage does not appear in the 1864 version of the Manual ll44l . the only one Miller might have seen while in 
the service; it does appear in the 1866 and later editions. It is unclear whether an ordinary soldier would have known 
of or remembered Myer, or been familiar with that book; someone who had worked in intelligence or cryptanalysis 
almost certainly would. Myer was reasonably prominent after the war, though; it is conceivable that the 1879 edition 
— the first to be issued by the Government Printing Office — or Myer's death in 1880 stimulated the creation of 
the codebook. 

We suspect that the compiler did not have hands-on experience as a code or communications clerk or as a crypt- 
analyst; such a person would have been more familiar with indicators, message serial numbers, telegrams being sent 
out of order, etc. On the other hand, the preface does discuss common transmission errors on telegraph systems (e.g., 
confusing some Morse symbols with others). It was comparatively unusual to see such discussions in codebooks of 
that era; this may indicate more than usual familiarity with telegraphy. 

It is fortunate indeed for our research that Frank Miller was a prominent person. He was sufficiently important that 
he was one of the original trustees of Stanford University and left a considerable paper trail, including coverage on 
the Society pages of the San Francisco Chronicle. Even more important, his descendants preserved information about 
him and someone compiled it all ll50l . 

5 Linkages 

The compiler of this codebook — we are certain that it was this Frank Miller — clearly developed the one-time pad; 
his influence on history, however, is much less clear It is much like the old philosophical conundrum of a tree falling 
in a forest with no one around: does it make a sound? Did Vernam or Mauborgne ever learn of Miller's work? Again, 
there are no firm answers; the best we can do is to speculate. 

We can almost certainly rule out contact with Vernam OTl . Vernam was an electrical engineer whose specialty 
was the encryption hardware; he was not a cryptologist. Kahn concluded long ago that Mauborgne, not Vernam, 
had the essential cryptologic insight on non-reuse of keys; see the endnote discussion about the development of the 
non-repeating key for a Vernam machine in ll29l . 

There was not much more chance of direct contact between Miller and Mauborgne. Mauborgne was not stationed 
in San Francisco until 1932 [551, well after the period of interest. He did pass through the port of San Francisco en 
route to the Philippines ifTTl . but any encounter with Miller would have been pure coincidence. There does, though, 
appear to have been one possible opportunity. Mauborgne's ship was scheduled to sail on November 5, 1913; there 
was a large ball to open the Portola Festival on October 23, and officers were invited [12J. However, we have not found 
any evidence that either he or Miller attended it. Neither is in the attendee list given in lITOl . though that article lists 
people who were ''among the invited guests" [emphasis added]. Furthermore, a quick scan of the Society columns of 
the San Francisco Chronicle shows very few mentions of Miller after 1910. 

A more intriguing possibility is contact between Miller and Parker Hitt. Hitt, an expert cryptologist and the author 
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of Manual for the Solution of Military Ciphers ETll . was Mauborgne's mentor and colleague. In 1914, he took a major 
step towards development of the one-time pad when he wrote "No message is safe in the Larrabee cipher unless the 
key phrase is comparable in length with the message itself" |29|; his first observations along that line were presented 
a few years earlier at an Army Signal School Technical Conference 1281 (The text makes it clear that he was worried 
about Kasicki superimpositions in what was essentially a Vignere cipher, rather than any more general principle. The 
text also notes that multiple encryption with keys of different lengths is not that strong, either; this was later relearned 
by Vernam and Mauborgne.) Kahn has conjectured that this observation resulted from joint work with Mauborgne; 
again, see the endnote discussion mentioned above. It is quite clear that if Hitt knew of Miller's system, he would have 
shared the information with Mauborgne when they were together at the Army Signal School in Fort Leavenworth. 

Crucially, it is virtually certain that Miller and Hitt did meet, and under circumstances where the codebook could 
very easily have come up in conversation. Hitt was stationed at the Presidio in San Francisco February-July 1906; 
according to his diary, he did attend a number of social functions during that time [26 1, though we do not know if 
Miller was at any of them. More importantly, Hitt and Miller both attended "the most brilliant military ball which 
San Franciscans remember to have seen in many years" 138). This party was hosted by "the bachelor officers of the 
Twenty-Second Infantry", including Hitt. The hosts "received the guests at the entrance to the hall, then escorting 
them to the ladies of the receiving party". Given that this was a party by "bachelor officers", and given that Miller and 
his wife were accompanied by their daughter Edith, it is hard to imagine that Hitt and Miller did not talk. Edith would 
have been regarded as highly eligible; she was 25, single, an "unusually attractive, charming girl" [39 | (also see her 
picture at ll50l p. 445]), a former Stanford student, and from a prominent, well-to-do family. She may herself have 
been looking; marriages to officers of that regiment were regarded as quite desirable |[39l . Indeed, six months later she 
married another officer listed as a host. Lieutenant Matthew H. Thomlinson |[37ll . 

Given this, we are convinced that Miller and Hitt at least exchanged greetings and probably chatted more. Fur- 
thermore, given that the ball was partly to celebrate the first anniversary of the regiment's return from the Philippines, 
we assume that Miller asked Hitt about his activities there. As it turns out, among other activities Hitt had set up 
communications lines. He was also very interested in telecommunications ll56l . Had this come up at all in conversa- 
tion, it strikes us as highly probable that Miller — a man who was interested in the subject, and knew of and quoted 
Myer's book — would have recounted his own efforts in the field. But Miller was brusque; it is also easy to imagine 
that his manner in speaking could have put off Hitt, who could easily have treated this as an amateur giving advice on 
telecommunications to someone who had done it in the real world. 

Speculation can only take us so far Simply mentioning authorship of a codebook, or even a codebook and su- 
perencipherment system, is very different from trying to explain shift-numbers at a party. Based on the evidence 
available thus far, we cannot quite conclude that Hitt knew enough about Miller's system to have been influenced by 
it. Conversely, of course, we also cannot conclude that he was ignorant of it. Perhaps one aspect — keying material as 
long as the plaintext — stayed with him and influenced his comments about the Larrabee system. 

Our overall verdict is "not proven". For effective transmission to have happened. Miller would have had to tell 
Hitt of his idea in some detail. Hitt would have had to retain enough memory of it to use in in formulating his maxim 
about key length, but not enough to actually credit Miller Thus, though Miller's idea may have lived on, if so it it was 
via a subconscious channel, and almost certainly through Hitt. (We also note that Mauborgne told Kahn that he came 
up with the idea himself while working with Vernam ll29l .) 

Drawing any further conclusions will be difficult unless more documentation is unearthed. Hitt's papers have been 
scrutinized by many historians; they are unlikely to hold any surprises, unless there are cryptic references to Miller 
that would have been meaningless without the context supplied here. Miller's papers and diary may hold clues; they 
existed at least as late as 1987 |50|, but we have been unable to locate them. (Neither of the two obvious repositories, 
Stanford University and the California State Library, has them.) We leave these matters to other historians who are 
more diligent, or who have access to resources that we do not. 

"^Kahn had speculated that Hitt formulated this precept before 1914. Research by Craig Bauer and Drew Wicke of York College of Pennsylvania 
and John W. Dawson, Jr, retired from Penn State University at York, has confirmed this. However, the note is by Hitt and Lieutenant Karl Truesdell, 
rather than with Mauborgne. Truesdell compiled the first set of multilingual frequency for the U.S. Army (29). 
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6 Conclusions 



It is clear that Miller invented the one-time pad: res ipsa loquitur His work was remarkable, not just because he 
invented a secure encryption scheme 35 years before it was reinvented, but also because it came out of the blue. 
Vernam and Mauborgne were working in the field; Vernam was trying to build a secure communications system and 
Mauborgne was the head of research and engineering for the U.S. Army Signal Corp. They were the sort of people 
one would expect to invent such a thing. Miller, on the other hand, was a banker, whose only first-hand experience 
with cryptology (if any) was likely 16 years earlier. Still, he was not the first amateur to make a significant contribution 
to the field. Indeed, Kahn has a chapter entitled "The Contribution of the Dilettantes". The most remarkable tale in 
that chapter is that of Thomas Jefferson, who invented a wheel cipher in the 1790s, an invention that was promptly 
forgotten and not rediscovered in his papers until 1922. Ironically enough, Jefferson's cipher was reinvented a few 
years before that by French cryptologist Etienne Bazeries; it was brought to the U.S. and refined by none other than 
Parker Hitt and Joseph Mauborgne]^ 

One can also speculate on the risks of tying a bad system — the conventional codebook Miller authored — to 
a good one. Had Miller published — and marketed — his superencipherment independently from his codebook, it 
might have succeeded. Robert Slater's codebook |52|, intended only for confidentiality, was even worse than Miller's 
for compression (though it had 25,000 words, compared with Miller's 12,800); despite that, the work went through 
nine editions, the last published in 1938 |53|, and even was the basis for a U.S. government codebook lfT4ll63l . The 
difference was likely marketing — Slater was secretary of the French Atlantic Telegraph Company — but regardless. 
Slater's work survived and was influential; Miller's work has been forgotten. 

It is tempting to speculate on how history may have been different had people paid attention. Almost certainly, 
one-time pads would never have been employed for most military communications; the operational difficulties, then 
as now, would have been prohibitive. But what of high-level diplomatic correspondence? Kahn tells many tales of 
cryptanalysis of such messages between 1882 and 1918; might things have been different? Might the German Foreign 
Ministry been able to protect Zimmernan's fateful telegram with a one-time pad if they had known of Miller's work? 
And if so, would the U.S. have entered World War I when it did? History might not have been changed — years later, 
the Japanese used their PURPLE machine for diplomatic messages, rather than a Vernam machine — but perhaps it 
might have been. 

Finally, it takes nothing away from Vernam or Mauborgne's own creativity to acknowledge that Miller had the 
same idea. If nothing else, their system — an online, automated mechanism that operated on the Os and Is of Baudot 
code — was far more usable and was the precursor to today's computerized stream ciphers. 
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The Preface to Miller's Codebook 



PREFACE. 




' #m ialuid tolestaphing, Mmplidty and speed are more importaDt 
^^ta "meonemy, WiUi oablegraniB the leverae is tlie cue. Cable 
'$fig\m 'Sainly composed of vast nnmbere of phrases, and are so 
'^i^llllifflie that few eoiuitry bankers will use them. 
■y:f^-"^tXil0tm years' bankiDg experience girea the compiler confidence 
- |lB'jMfa that this Cede will be carefully examined by bankers, and 
^llta^.tt isjll e»rreet a po^tlTe eHI.to wH»the relying npon hastily 
?;|fainwd: B^jrti^^phs, which contiDually repeat, and which are there- 
.^||lfei i|buic«roiMrhecaQae, if an operator should dedpber sqch a eys- 
i and send a message in such a cipher, great snspicion would arise 
■yMfiAifaii iSl partlea having acoees to such cryptographs. 

allows a cipher word to be used twice with the 
4A-f£Sr — j||j|g^eatiaQ is open to detection. A little talk with a tele- 
Oporttoc will oonvlQce one of this fact. 

Myofs Miys- ; " If signals are to be displayed in the pres- 
1m ilQCuny they most l>e guarded by ciphers whicli must be 
^ fraqwuit cbangBS, «jid the rales by which these changes 
;im4Aaka«t be dmple." 

wlebtion cif words in this t>ook has Iraen cuefully made, as- 
:i8 ^)< ife Wii> i !Hf -bainj; ha4 6oan axperts upon the phrases and dpher words. 
Jj^^lfplfi ^ pritt^pal «ltles, aomames, and Christian names will be 

lE^'lNflic «o«iiteln« 1S8D0 wiird|B and phrases, each having its 
"^iv^W^ihar littmbered ; then lollow 1700 dpher-words^ the hut 
' Aumhw i4M(vM6 being 14000. 

A fuglemen tary code, which can be osed with this, can thus 
H^jMda Jtgr^lilLhllg •U. or part, of the "extra cipher-words," and 
tl^^mwiw ifppoti^ each to Wit any special business. 
^.MnvM^aiim of the lAajority of usras^ten lists are pro- 
9ft «Spibw-w«vjIi to iMusb, for the regiatering of special 

||yait6m If :MN»latel7 It IA also tople and qaickly 

'|M^'WW ^I>n>ven by ft little practice. ^ 
^ B^'fc* **** meiM^tw and for joars, care being taken 

''-(^«n«|Kindeiita to h««p each other w^l i^ipplied with '^shift- 



• «l should send by mail an exact translation, 
^^P**^^S?ta^*>'t*4 of timemndloesof "shift-numbers," it will 
.^Jft^ff^^fl^* ^ ftgadn tKftnslate the message. 

M of Mhift^ambers" should be kept by one person in 
and from him one or more of the " shift-numberB*' may be 
"wsh-jflerks a« receive or send telegrams. 
'•"ntb» mwApr m^d noelver mast each cancel " shift-numbers '* as 
^^th^yare used, 




If th^ sender finds that the addition of a key produces a sum 
greater than the highest "serial number*' (14000) in this book, 
he must deduct said last " serial number " from said sum and count 
the excess from the first page. 

On the other hand, if the receiver finds tbat the "serial number'* 
of a dpher-word is lea$ than the luj which is to unlodL it, he mtist 
temporarily add to said " serial number ** the Idghest number in this 
book and deduct the key from the sum. 

This Code in itself does not give to any person the right to pre* 
Bume that its use in " plain dpher" has inch binding effect as if used 
in "shifted cipher." 

It is evident that many dispatches need not be in cipher ; such as 
ordering money by express from a reserve agent to go to the sender 
of the telegram, remarks about missing letters, and many others. 

Such messages can, for economy, be put in what we will call 
" pl#in dpher," which is taking the " dpher-word " cm the same line 
as printed. But few copies of this code will be in any town, and a 
message in "plain dpher" would practically insure j^it'tvie^. 

The rule would seem to be tliat all messages which could l>e sent 
TKBBALLT by a messenger; may be sent in plain English or *' plain 
cipher." 

The payment of money, or any other action which would require 
written authority, and which would not be done when such order was 
sent verbally by messenger, it ia evident, requires a test of genuine- 
ness that must be infallible. 

. Such testa of genuineness and also methods for renderinga message 
absolutely secret ar^ to be had by the use of " shift-numbers," as 
hereafter described. 

Words should be written plainly, so the operator may not err in 
sending messages. 

Hlstakes in sending will sometimes occur : thus O - - > and 
19 will be confused, making "came" read "same/' Ac, &c. 
Also O «i - and £2 - £ - making " son " read " seen," &c 
Also R- and S**" making " aaXl'* read "rail," &c 
Also by misdng a dot, I* will be taken for IX ; jF f or A. or ; 
O for £2, &c. 
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A copy of this Code has been sent to, and will remain with, each 
bank in New York City, whose address and " cipher- word" follows 
hereafter. 

A copy has- likewise been sent to each bank which Is a member 
(in 1833) of the Clearing Honse in Chicago, St. Lools, New Orleans, 
and San Francisco. 

This Code is stereotyped and no changes will be made at any 
time. 

SHIFT-NUMBERS. 

A banker in the West should prepare a list of irregular nnmbers, 
to be called " shift-numbers," such as 483, 381, 175, 892, tec. 

The differences between such numbers muat not be regular. 

When a sblft number has been applied, or used, it mnst be 
erased from the liet and n- 1 used again. 

A copy of the list is to be sent to the New York Banker, who 
prepares a deferent Htt and sends copy thereof to the Western 
Banker. 

Each party should enter his own list in black ink in a book, and 
copy his correspondent's list in red ink upon the opposite page ; thus 
the black fignres will denote his " sending numbers," and ths red 
figures will denote his " receiring numbers." 

Having occasion to telegraph an order requiring the payment of 
money, and knowing that an English dispatch would reeeiTa no 
attention, the Western lianker will write his dispatch on a sheet of 
paper, ISaving a few lines blank between the written lines. 

He will then find bis first word in this Code, and copy upon the 
sheet of paper its number, placing the number under the word. 

Under said nnmlier (which we wiil call the " serial-number ") he 
win place the flrst " shift-number" (say 483). He will then add the 
two numbers and find their sum, which he will write down. 

Underneath this new sum, or number, ho will write the " cipher- 
word" which he shall find in the Code standing alongside of said 
sum. 

Thus he gets the first cipher-word for his telegram. 

To the appropriate " serial number " of the second word he will 
add the second " shift-number" (say 281), and, finding their sum, he 
will take the cipher-word wliich is found opposite said sum. 
• He will follow the same plan with the remaining words. 



EXAMPLE. 

Extended for eight days 

4661 4943 226 3371 

483 381 175 893 

5134 5333 401 4163 

Oentleness Olaired Allegro Fantasbk 



The receiver will reverse the operation, writing down the first 
cipher-word of the telegram ; under it platnng its " serial number," 
and from that deducthig the first "shtlt number " (say 488), thus 
finding the "serial numlier" of the first English word transmitted. 

From the serial number of the second cipher. word in the telegram 
he will deduct the second "sltlft-number" (say 281), thus finding the 
serial number of the second English word transmitted. 



EXAMPLE. 

Gentleness Olaiied Allegro Fantasia 

5134 6338 401 4168 

483 381 ■ 176 893 

4651 4942 326 3271 

Extended for eight days 



For many telegrams it will suffice that the common English 
words be used with a " test word " that shall indicate that the 
dispatch was geituine cm gent. Economy and much safety can also be 
secured liy using a " test word" and placing the rest of the message in 
plain dpihn"— that is, using the Cods as printed without any 
"shifting." 

The sender will, in sndi cases, take the two light-hand figure* of 
his first *' sbifUnnmber," and use the test word indicated by such two ' 
figures ; thus ' he will use the test word ** Abstrnse" if his first key 
is 488, and place tlierest of the msssage in English or in "plain 
cipher," 

The receiver will note that a " test word" is used, and tliat Its 
number is the same as the two right-hand figures of the&ey (or 
" Bhift-nnm1»r"), which is then available. 

Said "shift-number" must, of course, be then erased hy both 
sender and recover, for it is void for further use. 

EXAMPLE. 

Abstruse Foredated Furuncle Admirers IHsgnsted 
AlMtruse : Extended tor eight days. 
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